Skip to content

Commit 3f71599

Browse files
tijmenbruggemantijmenbruggeman
authored
PHPCS - WordPress.Security.EscapeOutput (#110)
* autofixes * remove prefix underscores * fix spacing in resize text * move whitespace * Do not escale error messages before being outputted to html * Unexclude escape output * phpcs: bulk-optimization.php * phpcs account-status-create-advanced * phpcs compress-details-processing * fix create-simpel * phpcs dashboard-widget * phpcs optimization-chart * phpcs status-connected * phpcs compress-details * phpcs upgrade notice * notice-feedback * exceptions are handled on client usage in views * phpcs notices * phpcs class-tiny-compress.php * phpcs settings * phpcs tiny-plugin * remove parameter * use Tiny_Image * typo * ignore exception, is not outputted * use esc_url instead of esc_html on urls * add checked mock func * fix test
1 parent 5324118 commit 3f71599

20 files changed

Lines changed: 246 additions & 145 deletions

‎phpcs.xml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
<exclude name="Squiz.PHP.CommentedOutCode.Found" />
1212

1313
<!-- Fix security issues -->
14-
<exclude name="WordPress.Security.EscapeOutput" />
1514
<exclude name="WordPress.Security.ValidatedSanitizedInput" />
1615
<exclude name="WordPress.Security.NonceVerification" />
1716

‎src/class-tiny-compress-client.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
<?php
2+
// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped
23
/*
34
* Tiny Compress Images - WordPress plugin.
45
* Copyright (C) 2015-2018 Tinify B.V.

‎src/class-tiny-compress-fopen.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
<?php
2+
// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped
23
/*
34
* Tiny Compress Images - WordPress plugin.
45
* Copyright (C) 2015-2018 Tinify B.V.

‎src/class-tiny-compress.php‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,14 +109,17 @@ public function compress_file(
109109
$convert_to = array()
110110
) {
111111
if ( $this->get_key() == null ) {
112+
// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- not used in output
112113
throw new Tiny_Exception( self::KEY_MISSING, 'KeyError' );
113114
}
114115

115116
if ( ! file_exists( $file ) ) {
117+
// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- not used in output
116118
throw new Tiny_Exception( self::FILE_MISSING, 'FileError' );
117119
}
118120

119121
if ( ! is_writable( $file ) ) {
122+
// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- not used in output
120123
throw new Tiny_Exception( self::WRITE_ERROR, 'FileError' );
121124
}
122125

@@ -141,7 +144,7 @@ public function compress_file(
141144
try {
142145
file_put_contents( $file, $output );
143146
} catch ( Exception $e ) {
144-
throw new Tiny_Exception( $e->getMessage(), 'FileError' );
147+
throw new Tiny_Exception( esc_html( $e->getMessage() ), 'FileError' );
145148
}
146149

147150
if ( $convert_output ) {
@@ -153,7 +156,7 @@ public function compress_file(
153156
try {
154157
file_put_contents( $converted_filepath, $convert_output );
155158
} catch ( Exception $e ) {
156-
throw new Tiny_Exception( $e->getMessage(), 'FileError' );
159+
throw new Tiny_Exception( esc_html( $e->getMessage() ), 'FileError' );
157160
}
158161
$details['convert']['path'] = $converted_filepath;
159162
}

‎src/class-tiny-image-size.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,6 @@ public function mark_duplicate( $duplicate_size_name ) {
231231
$this->duplicate = true;
232232
$this->duplicate_of_size = $duplicate_size_name;
233233
}
234-
235234
public function is_duplicate() {
236235
return $this->duplicate;
237236
}

‎src/class-tiny-notices.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,16 +172,17 @@ public function show( $name, $message, $klass = 'error', $dismissible = true ) {
172172
}
173173

174174
$css = implode( ' ', $css );
175-
$plugin_name = esc_html__(
175+
$plugin_name = __(
176176
'TinyPNG - JPEG, PNG & WebP image compression',
177177
'tiny-compress-images'
178178
);
179179

180180
add_action(
181181
'admin_notices',
182182
function () use ( $css, $name, $plugin_name, $message, $add ) {
183-
echo '<div class="' . $css . '" data-name="' . $name . '"><p>' .
184-
$plugin_name . ': ' . $message . $add . '</div>';
183+
echo '<div class="' . esc_attr( $css ) . '" data-name="' .
184+
esc_attr( $name ) . '"><p>' . esc_html( $plugin_name ) .
185+
': ' . wp_kses_post( $message ) . wp_kses_post( $add ) . '</div>';
185186
}
186187
);
187188
}
@@ -324,7 +325,7 @@ private function show_incompatible_plugins( $incompatible_plugins ) {
324325
add_action(
325326
'admin_notices',
326327
function () use ( $notice ) {
327-
echo $notice;
328+
echo wp_kses_post( $notice );
328329
}
329330
);
330331
}

‎src/class-tiny-plugin.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -547,7 +547,7 @@ private function validate_ajax_attachment_request() {
547547
public function compress_image_from_library() {
548548
$response = $this->validate_ajax_attachment_request();
549549
if ( isset( $response['error'] ) ) {
550-
echo $response['error'];
550+
echo esc_html( $response['error'] );
551551
exit();
552552
}
553553
list($id, $metadata) = $response['data'];
@@ -570,7 +570,7 @@ public function compress_image_from_library() {
570570
// anymore, so other plugins are less likely to be triggered.
571571
wp_update_attachment_metadata( $id, $tiny_image->get_wp_metadata() );
572572

573-
echo $this->render_compress_details( $tiny_image );
573+
$this->render_compress_details( $tiny_image );
574574

575575
exit();
576576
}
@@ -656,14 +656,14 @@ public function ajax_compression_status() {
656656
$response = $this->validate_ajax_attachment_request();
657657

658658
if ( isset( $response['error'] ) ) {
659-
echo $response['error'];
659+
echo esc_html( $response['error'] );
660660
exit();
661661
}
662662
list($id, $metadata) = $response['data'];
663663

664664
$tiny_image = new Tiny_Image( $this->settings, $id, $metadata );
665665

666-
echo $this->render_compress_details( $tiny_image );
666+
$this->render_compress_details( $tiny_image );
667667

668668
exit();
669669
}
@@ -877,15 +877,15 @@ public static function uninstall() {
877877
public function mark_image_as_compressed() {
878878
$response = $this->validate_ajax_attachment_request();
879879
if ( isset( $response['error'] ) ) {
880-
echo $response['error'];
880+
echo esc_html( $response['error'] );
881881
exit();
882882
}
883883

884884
list($id, $metadata) = $response['data'];
885885
$tiny_image = new Tiny_Image( $this->settings, $id, $metadata );
886886
$tiny_image->mark_as_compressed();
887887

888-
echo $this->render_compress_details( $tiny_image );
888+
$this->render_compress_details( $tiny_image );
889889

890890
exit();
891891
}

‎src/class-tiny-settings.php‎

Lines changed: 30 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -460,7 +460,14 @@ public function render_settings_moved() {
460460
),
461461
)
462462
),
463-
$link
463+
wp_kses(
464+
$link,
465+
array(
466+
'a' => array(
467+
'href' => array(),
468+
),
469+
)
470+
)
464471
);
465472
echo '</div>';
466473
}
@@ -470,14 +477,14 @@ public function render_compression_timing_settings() {
470477
'When should new images be compressed?',
471478
'tiny-compress-images'
472479
);
473-
echo '<h4>' . $heading . '</h4>';
480+
echo '<h4>' . esc_html( $heading ) . '</h4>';
474481
echo '<div class="optimization-options">';
475482

476483
$name = self::get_prefixed_name( 'compression_timing' );
477484
$compression_timing = $this->get_compression_timing();
478485

479486
$id = self::get_prefixed_name( 'background_compress_enabled' );
480-
$checked = ( 'background' === $compression_timing ? ' checked="checked"' : '' );
487+
$checked = ( 'background' === $compression_timing );
481488

482489
$label = esc_html__(
483490
'Compress new images in the background (Recommended)',
@@ -493,12 +500,11 @@ public function render_compression_timing_settings() {
493500
$label,
494501
$description,
495502
'background',
496-
$checked,
497-
false
503+
$checked
498504
);
499505

500506
$id = self::get_prefixed_name( 'auto_compress_enabled' );
501-
$checked = ( 'auto' === $compression_timing ? ' checked="checked"' : '' );
507+
$checked = ( 'auto' === $compression_timing );
502508

503509
$label = esc_html__(
504510
'Compress new images during upload',
@@ -514,12 +520,11 @@ public function render_compression_timing_settings() {
514520
$label,
515521
$description,
516522
'auto',
517-
$checked,
518-
false
523+
$checked
519524
);
520525

521526
$id = self::get_prefixed_name( 'auto_compress_disabled' );
522-
$checked = ( 'manual' === $compression_timing ? ' checked="checked"' : '' );
527+
$checked = ( 'manual' === $compression_timing );
523528

524529
$label = esc_html__(
525530
'Do not compress new images automatically',
@@ -535,16 +540,16 @@ public function render_compression_timing_settings() {
535540
$label,
536541
$description,
537542
'manual',
538-
$checked,
539-
false
543+
$checked
540544
);
541545

542546
echo '</div>';
543547
}
544548

545549
public function render_sizes() {
550+
$dummy_size_name = self::get_prefixed_name( 'sizes[' . self::DUMMY_SIZE . ']' );
546551
echo '<input type="hidden" name="' .
547-
self::get_prefixed_name( 'sizes[' . self::DUMMY_SIZE . ']' ) . '" value="on"/>';
552+
esc_attr( $dummy_size_name ) . '" value="on"/>';
548553

549554
foreach ( $this->get_sizes() as $size => $option ) {
550555
$this->render_size_checkboxes( $size, $option );
@@ -568,7 +573,7 @@ public function render_sizes() {
568573
private function render_size_checkboxes( $size, $option ) {
569574
$id = self::get_prefixed_name( "sizes_$size" );
570575
$name = self::get_prefixed_name( 'sizes[' . $size . ']' );
571-
$checked = ( $option['tinify'] ? ' checked="checked"' : '' );
576+
$checked = ! empty( $option['tinify'] );
572577
if ( Tiny_Image::is_original( $size ) ) {
573578
$label = esc_html__( 'Original image', 'tiny-compress-images' ) . ' (' .
574579
esc_html__(
@@ -592,9 +597,9 @@ private function render_size_checkboxes( $size, $option ) {
592597
. ' - ' . $width . 'x' . $height;
593598
}
594599
echo '<p>';
595-
echo '<input type="checkbox" id="' . $id . '" name="' . $name .
596-
'" value="on" ' . $checked . '/>';
597-
echo '<label for="' . $id . '">' . $label . '</label>';
600+
echo '<input type="checkbox" id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) .
601+
'" value="on"' . checked( $checked, true, false ) . '/>';
602+
echo '<label for="' . esc_attr( $id ) . '">' . esc_html( $label ) . '</label>';
598603
echo '</p>';
599604
}
600605

@@ -646,7 +651,7 @@ public function render_size_checkboxes_description(
646651
),
647652
$strong
648653
),
649-
$free_images_per_month
654+
esc_html( $free_images_per_month )
650655
);
651656

652657
if ( self::wr2x_active() ) {
@@ -683,7 +688,7 @@ public function render_compression_timing_radiobutton(
683688
'For compression to work you will need to configure WP Offload S3 to keep a copy of the images on the server.',
684689
'tiny-compress-images'
685690
);
686-
echo $message;
691+
echo esc_html( $message );
687692
echo '</p></div>';
688693
echo '<p class="tiny-radio disabled">';
689694
} else {
@@ -693,11 +698,11 @@ public function render_compression_timing_radiobutton(
693698
$id = sprintf( self::get_prefixed_name( 'compression_timing_%s' ), $value );
694699
$label = esc_html( $label );
695700
$desc = esc_html( $desc );
696-
echo '<input type="radio" id="' . $id . '" name="' . $name .
697-
'" value="' . $value . '" ' . $checked . '/>';
698-
echo '<label for="' . $id . '">' . $label . '</label>';
701+
echo '<input type="radio" id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) .
702+
'" value="' . esc_attr( $value ) . '"' . checked( $checked, true, false ) . '/>';
703+
echo '<label for="' . esc_attr( $id ) . '">' . esc_html( $label ) . '</label>';
699704
echo '<br>';
700-
echo '<span>' . $desc . '</span>';
705+
echo '<span>' . esc_html( $desc ) . '</span>';
701706
echo '</p>';
702707
}
703708

@@ -955,11 +960,11 @@ private static function render_radiobutton(
955960
$label,
956961
$descr
957962
) {
958-
$checked = ( $current_value === $option_value ? ' checked="checked"' : '' );
963+
$checked = ( $current_value === $option_value );
959964
echo '<p class="tiny-radio">';
960965
echo '<input type="radio" data-testid="' . esc_attr( $option_id ) . '" ';
961-
echo 'id="' . esc_attr( $option_id ) . '" name="' . $group_name .
962-
'" value="' . esc_attr( $option_value ) . '" ' . $checked . '/>';
966+
echo 'id="' . esc_attr( $option_id ) . '" name="' . esc_attr( $group_name ) .
967+
'" value="' . esc_attr( $option_value ) . '"' . checked( $checked, true, false ) . '/>';
963968
echo '<label for="' . esc_attr( $option_id ) . '">' . esc_html( $label );
964969
echo '<span>' . esc_html( $descr ) . '</span>';
965970
echo '</label>';

‎src/views/account-status-connected.php‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
<?php
2+
/**
3+
* Account status connected view.
4+
*
5+
* Account connection status.
6+
* @var object $status {
7+
* @type bool $ok Whether the API connection is successful.
8+
* @type bool $pending Whether the connection is pending activation.
9+
* @type string|null $message Optional status message.
10+
* }
11+
* @var string $key The API key.
12+
*/
13+
?>
114
<div class="tiny-account-status" id="tiny-account-status" data-state="complete">
215
<div class="status <?php echo $status->ok ? ( $status->pending ? 'status-pending' : 'status-success' ) : 'status-failure'; ?>">
316
<p class="status"><span>
@@ -39,7 +52,7 @@
3952
),
4053
$strong
4154
),
42-
$remaining_credits
55+
intval( $remaining_credits )
4356
);
4457
} elseif ( ! $status->pending ) {
4558
printf(
@@ -48,7 +61,7 @@
4861
'You have made %s compressions this month.',
4962
'tiny-compress-images'
5063
),
51-
$compressions
64+
intval( $compressions )
5265
);
5366
}
5467
} elseif ( isset( $status->message ) ) {
@@ -92,7 +105,15 @@
92105
'Enter your API key. If you have lost your key, go to your %s to retrieve it.',
93106
'tiny-compress-images'
94107
),
95-
$link
108+
wp_kses(
109+
$link,
110+
array(
111+
'a' => array(
112+
'href' => array(),
113+
'target' => array(),
114+
),
115+
)
116+
)
96117
);
97118
?>
98119
</p>
@@ -115,7 +136,7 @@
115136
<div class="button-container">
116137
<div class="box">
117138
<?php $encoded_email = str_replace( '%20', '%2B', rawurlencode( self::get_email_address() ) ); ?>
118-
<a href="https://tinypng.com/dashboard/api?type=upgrade&mail=<?php echo $encoded_email; ?>" target="_blank" class="button button-primary upgrade-account">
139+
<a href="<?php echo esc_url( 'https://tinypng.com/dashboard/api?type=upgrade&mail=' . $encoded_email ); ?>" target="_blank" class="button button-primary upgrade-account">
119140
<?php esc_html_e( 'Upgrade account', 'tiny-compress-images' ); ?>
120141
</a>
121142
</div>

‎src/views/account-status-create-advanced.php‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,12 @@
4747
'<a href="https://tinypng.com/dashboard/api" target="_blank">%s</a>',
4848
esc_html__( 'API dashboard', 'tiny-compress-images' )
4949
);
50-
printf(
51-
/* translators: %s: link saying API dashboard */
52-
esc_html__(
53-
'Enter your API key. Go to your %s to retrieve it.',
54-
'tiny-compress-images'
55-
),
56-
$link
50+
echo wp_kses_post(
51+
sprintf(
52+
/* translators: %s: link saying API dashboard */
53+
__( 'Enter your API key. Go to your %s to retrieve it.', 'tiny-compress-images' ),
54+
$link
55+
)
5756
);
5857
?>
5958
</p>

0 commit comments

Comments
 (0)